[PATCH] xfrm: serialize SA activation with state deletion

[Kyle Zeng]

xfrm_add_sa() publishes a newly constructed state and arms its lifetime
timer before marking it VALID. The final VOID-to-VALID test and store
are not serialized with state deletion. If hard expiry deletes the state
between the test and the store, the store resurrects the unlinked state.

An input lookup which found the state before it was removed can then add
it to the per-CPU cache after deletion has removed the cache entries.
Once the remaining references are dropped, the cache points to freed
memory.

Take x->lock around the conditional transition, with bottom halves
disabled as in xfrm_state_delete(). This preserves DEAD if expiry won
the race. The same protection covers UPDSA when it installs a replacement
for an ACQ state.

Fixes: cc01572e2fb0 ("xfrm: Add SA to hardware at the end of xfrm_state_construct()")
Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>
---
I have a reproducer for this issue and can share via DM

 net/xfrm/xfrm_user.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index a2587c7e796b..b47e5952f619 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1068,8 +1068,10 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
 		goto out;
 	}
 
+	spin_lock_bh(&x->lock);
 	if (x->km.state == XFRM_STATE_VOID)
 		x->km.state = XFRM_STATE_VALID;
+	spin_unlock_bh(&x->lock);
 
 	c.seq = nlh->nlmsg_seq;
 	c.portid = nlh->nlmsg_pid;

base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3
-- 
2.56.0